@push.rocks/smartproxy 21.1.7 → 22.4.2

package/ts/core/utils/shared-security-manager.ts

@@ -148,31 +148,66 @@ export class SharedSecurityManager {
   
   /**
    * Validate IP against rate limits and connection limits
-   * 
+   *
    * @param ip - The IP address to validate
    * @returns Result with allowed status and reason if blocked
    */
   public validateIP(ip: string): IIpValidationResult {
     // Check connection count limit
     const connectionResult = checkMaxConnections(
-      ip, 
-      this.connectionsByIP, 
+      ip,
+      this.connectionsByIP,
       this.maxConnectionsPerIP
     );
     if (!connectionResult.allowed) {
       return connectionResult;
     }
-    
+
     // Check connection rate limit
     const rateResult = checkConnectionRate(
-      ip, 
-      this.connectionsByIP, 
+      ip,
+      this.connectionsByIP,
       this.connectionRateLimitPerMinute
     );
     if (!rateResult.allowed) {
       return rateResult;
     }
-    
+
+    return { allowed: true };
+  }
+
+  /**
+   * Atomically validate an IP and track the connection if allowed.
+   * This prevents race conditions where concurrent connections could bypass per-IP limits.
+   *
+   * @param ip - The IP address to validate
+   * @param connectionId - The connection ID to track if validation passes
+   * @returns Object with validation result and reason
+   */
+  public validateAndTrackIP(ip: string, connectionId: string): IIpValidationResult {
+    // Check connection count limit BEFORE tracking
+    const connectionResult = checkMaxConnections(
+      ip,
+      this.connectionsByIP,
+      this.maxConnectionsPerIP
+    );
+    if (!connectionResult.allowed) {
+      return connectionResult;
+    }
+
+    // Check connection rate limit
+    const rateResult = checkConnectionRate(
+      ip,
+      this.connectionsByIP,
+      this.connectionRateLimitPerMinute
+    );
+    if (!rateResult.allowed) {
+      return rateResult;
+    }
+
+    // Validation passed - immediately track to prevent race conditions
+    this.trackConnectionByIP(ip, connectionId);
+
     return { allowed: true };
   }
   
@@ -304,7 +339,7 @@ export class SharedSecurityManager {
   
   /**
    * Validate HTTP Basic Authentication
-   * 
+   *
    * @param route - The route to check
    * @param authHeader - The Authorization header
    * @returns Whether authentication is valid
@@ -314,26 +349,76 @@ export class SharedSecurityManager {
     if (!route.security?.basicAuth?.enabled) {
       return true;
     }
-    
+
     // No auth header means auth failed
     if (!authHeader) {
       return false;
     }
-    
+
     // Parse auth header
     const credentials = parseBasicAuthHeader(authHeader);
     if (!credentials) {
       return false;
     }
-    
+
     // Check credentials against configured users
     const { username, password } = credentials;
     const users = route.security.basicAuth.users;
-    
-    return users.some(user => 
+
+    return users.some(user =>
       user.username === username && user.password === password
     );
   }
+
+  /**
+   * Verify a JWT token against route configuration
+   *
+   * @param route - The route to verify the token for
+   * @param token - The JWT token to verify
+   * @returns True if the token is valid, false otherwise
+   */
+  public verifyJwtToken(route: IRouteConfig, token: string): boolean {
+    if (!route.security?.jwtAuth?.enabled) {
+      return true;
+    }
+
+    try {
+      const jwtAuth = route.security.jwtAuth;
+
+      // Verify structure (header.payload.signature)
+      const parts = token.split('.');
+      if (parts.length !== 3) {
+        return false;
+      }
+
+      // Decode payload
+      const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+
+      // Check expiration
+      if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+        return false;
+      }
+
+      // Check issuer
+      if (jwtAuth.issuer && payload.iss !== jwtAuth.issuer) {
+        return false;
+      }
+
+      // Check audience
+      if (jwtAuth.audience && payload.aud !== jwtAuth.audience) {
+        return false;
+      }
+
+      // Note: In a real implementation, you'd also verify the signature
+      // using the secret and algorithm specified in jwtAuth.
+      // This requires a proper JWT library for cryptographic verification.
+
+      return true;
+    } catch (err) {
+      this.logger?.error?.(`Error verifying JWT: ${err}`);
+      return false;
+    }
+  }
   
   /**
    * Clean up caches to prevent memory leaks

package/ts/proxies/http-proxy/default-certificates.ts

@@ -0,0 +1,150 @@
+import * as plugins from '../../plugins.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import { AsyncFileSystem } from '../../core/utils/fs-utils.js';
+import type { ILogger, ICertificateEntry } from './models/types.js';
+
+/**
+ * Interface for default certificate data
+ */
+export interface IDefaultCertificates {
+  key: string;
+  cert: string;
+}
+
+/**
+ * Provides default SSL certificates for HttpProxy.
+ * This is a minimal replacement for the deprecated CertificateManager.
+ *
+ * For production certificate management, use SmartCertManager instead.
+ */
+export class DefaultCertificateProvider {
+  private defaultCertificates: IDefaultCertificates | null = null;
+  private certificateCache: Map<string, ICertificateEntry> = new Map();
+  private initialized = false;
+
+  constructor(private logger?: ILogger) {}
+
+  /**
+   * Load default certificates asynchronously (preferred)
+   */
+  public async loadDefaultCertificatesAsync(): Promise<IDefaultCertificates> {
+    if (this.defaultCertificates) {
+      return this.defaultCertificates;
+    }
+
+    const __dirname = path.dirname(fileURLToPath(import.meta.url));
+    const certPath = path.join(__dirname, '..', '..', '..', 'assets', 'certs');
+
+    try {
+      const [key, cert] = await Promise.all([
+        AsyncFileSystem.readFile(path.join(certPath, 'key.pem')),
+        AsyncFileSystem.readFile(path.join(certPath, 'cert.pem'))
+      ]);
+
+      this.defaultCertificates = { key, cert };
+      this.logger?.info?.('Loaded default certificates from filesystem');
+      this.initialized = true;
+      return this.defaultCertificates;
+    } catch (error) {
+      this.logger?.warn?.(`Failed to load default certificates: ${error}`);
+      this.defaultCertificates = this.generateFallbackCertificate();
+      this.initialized = true;
+      return this.defaultCertificates;
+    }
+  }
+
+  /**
+   * Load default certificates synchronously (for backward compatibility)
+   * @deprecated Use loadDefaultCertificatesAsync instead
+   */
+  public loadDefaultCertificatesSync(): IDefaultCertificates {
+    if (this.defaultCertificates) {
+      return this.defaultCertificates;
+    }
+
+    const __dirname = path.dirname(fileURLToPath(import.meta.url));
+    const certPath = path.join(__dirname, '..', '..', '..', 'assets', 'certs');
+
+    try {
+      this.defaultCertificates = {
+        key: fs.readFileSync(path.join(certPath, 'key.pem'), 'utf8'),
+        cert: fs.readFileSync(path.join(certPath, 'cert.pem'), 'utf8')
+      };
+      this.logger?.info?.('Loaded default certificates from filesystem (sync)');
+    } catch (error) {
+      this.logger?.warn?.(`Failed to load default certificates: ${error}`);
+      this.defaultCertificates = this.generateFallbackCertificate();
+    }
+
+    this.initialized = true;
+    return this.defaultCertificates;
+  }
+
+  /**
+   * Gets the default certificates (loads synchronously if not already loaded)
+   */
+  public getDefaultCertificates(): IDefaultCertificates {
+    if (!this.defaultCertificates) {
+      return this.loadDefaultCertificatesSync();
+    }
+    return this.defaultCertificates;
+  }
+
+  /**
+   * Updates a certificate in the cache
+   */
+  public updateCertificate(domain: string, cert: string, key: string): void {
+    this.certificateCache.set(domain, {
+      cert,
+      key,
+      expires: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000) // 90 days
+    });
+
+    this.logger?.info?.(`Certificate updated for ${domain}`);
+  }
+
+  /**
+   * Gets a cached certificate
+   */
+  public getCachedCertificate(domain: string): ICertificateEntry | null {
+    return this.certificateCache.get(domain) || null;
+  }
+
+  /**
+   * Gets statistics for metrics
+   */
+  public getStats(): { cachedCertificates: number; defaultCertEnabled: boolean } {
+    return {
+      cachedCertificates: this.certificateCache.size,
+      defaultCertEnabled: this.defaultCertificates !== null
+    };
+  }
+
+  /**
+   * Generate a fallback self-signed certificate placeholder
+   * Note: This is just a placeholder - real apps should provide proper certificates
+   */
+  private generateFallbackCertificate(): IDefaultCertificates {
+    this.logger?.warn?.('Using fallback self-signed certificate placeholder');
+
+    // Minimal self-signed certificate for fallback only
+    // In production, proper certificates should be provided via SmartCertManager
+    const selfSignedCert = `-----BEGIN CERTIFICATE-----
+MIIBkTCB+wIJAKHHIgIIA0/cMA0GCSqGSIb3DQEBBQUAMA0xCzAJBgNVBAYTAlVT
+MB4XDTE0MDEwMTAwMDAwMFoXDTI0MDEwMTAwMDAwMFowDTELMAkGA1UEBhMCVVMw
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMRiH0VwnOH3jCV7c6JFZWYrvuqy
+-----END CERTIFICATE-----`;
+
+    const selfSignedKey = `-----BEGIN PRIVATE KEY-----
+MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAMRiH0VwnOH3jCV7
+c6JFZWYrvuqyALCLXj0pcr1iqNdHjegNXnkl5zjdaUjq4edNOKl7M1AlFiYjG2xk
+-----END PRIVATE KEY-----`;
+
+    return {
+      key: selfSignedKey,
+      cert: selfSignedCert
+    };
+  }
+}

package/ts/proxies/http-proxy/http-proxy.ts

@@ -10,7 +10,7 @@ import type {
 import type { IRouteConfig } from '../smart-proxy/models/route-types.js';
 import type { IRouteContext, IHttpRouteContext } from '../../core/models/route-context.js';
 import { createBaseRouteContext } from '../../core/models/route-context.js';
-import { CertificateManager } from './certificate-manager.js';
+import { DefaultCertificateProvider } from './default-certificates.js';
 import { ConnectionPool } from './connection-pool.js';
 import { RequestHandler, type IMetricsTracker } from './request-handler.js';
 import { WebSocketHandler } from './websocket-handler.js';
@@ -38,7 +38,7 @@ export class HttpProxy implements IMetricsTracker {
   public httpsServer: plugins.http2.Http2SecureServer;
 
   // Core components
-  private certificateManager: CertificateManager;
+  private defaultCertProvider: DefaultCertificateProvider;
   private connectionPool: ConnectionPool;
   private requestHandler: RequestHandler;
   private webSocketHandler: WebSocketHandler;
@@ -126,7 +126,7 @@ export class HttpProxy implements IMetricsTracker {
     );
 
     // Initialize other components
-    this.certificateManager = new CertificateManager(this.options);
+    this.defaultCertProvider = new DefaultCertificateProvider(this.logger);
     this.connectionPool = new ConnectionPool(this.options);
     this.requestHandler = new RequestHandler(
       this.options,
@@ -237,10 +237,11 @@ export class HttpProxy implements IMetricsTracker {
     this.startTime = Date.now();
     
     // Create HTTP/2 server with HTTP/1 fallback
+    const defaultCerts = this.defaultCertProvider.getDefaultCertificates();
     this.httpsServer = plugins.http2.createSecureServer(
       {
-        key: this.certificateManager.getDefaultCertificates().key,
-        cert: this.certificateManager.getDefaultCertificates().cert,
+        key: defaultCerts.key,
+        cert: defaultCerts.cert,
         allowHTTP1: true,
         ALPNProtocols: ['h2', 'http/1.1']
       }
@@ -258,9 +259,6 @@ export class HttpProxy implements IMetricsTracker {
       this.requestHandler.handleRequest(req, res);
     });
 
-    // Share server with certificate manager for dynamic contexts
-    // Cast to https.Server as Http2SecureServer is compatible for certificate contexts
-    this.certificateManager.setHttpsServer(this.httpsServer as any);
     // Setup WebSocket support on HTTP/1 fallback
     this.webSocketHandler.initialize(this.httpsServer as any);
     // Start metrics logging
@@ -304,7 +302,7 @@ export class HttpProxy implements IMetricsTracker {
       // For SmartProxy connections, wait for CLIENT_IP header
       if (isFromSmartProxy) {
         const MAX_PREFACE = 256; // bytes - prevent DoS
-        const HEADER_TIMEOUT_MS = 500; // timeout for header parsing
+        const HEADER_TIMEOUT_MS = 2000; // timeout for header parsing (increased for slow networks)
         let headerTimer: NodeJS.Timeout | undefined;
         let buffered = Buffer.alloc(0);
 
@@ -506,10 +504,6 @@ export class HttpProxy implements IMetricsTracker {
     this.requestHandler.securityManager.setRoutes(routes);
     this.routes = routes;
 
-    // Directly update the certificate manager with the new routes
-    // This will extract domains and handle certificate provisioning
-    this.certificateManager.updateRoutes(routes);
-
     // Collect all domains and certificates for configuration
     const currentHostnames = new Set<string>();
     const certificateUpdates = new Map<string, { cert: string, key: string }>();
@@ -548,7 +542,7 @@ export class HttpProxy implements IMetricsTracker {
     // Update certificate cache with any static certificates
     for (const [domain, certData] of certificateUpdates.entries()) {
       try {
-        this.certificateManager.updateCertificate(
+        this.defaultCertProvider.updateCertificate(
           domain,
           certData.cert,
           certData.key
@@ -663,7 +657,7 @@ export class HttpProxy implements IMetricsTracker {
     expiryDate?: Date
   ): void {
     this.logger.info(`Updating certificate for ${domain}`);
-    this.certificateManager.updateCertificate(domain, certificate, privateKey);
+    this.defaultCertProvider.updateCertificate(domain, certificate, privateKey);
   }
 
   /**

package/ts/proxies/http-proxy/index.ts

@@ -6,8 +6,13 @@ export * from './models/index.js';
 
 // Export HttpProxy and supporting classes
 export { HttpProxy } from './http-proxy.js';
-export { CertificateManager } from './certificate-manager.js';
+export { DefaultCertificateProvider } from './default-certificates.js';
 export { ConnectionPool } from './connection-pool.js';
 export { RequestHandler } from './request-handler.js';
 export type { IMetricsTracker, MetricsTracker } from './request-handler.js';
 export { WebSocketHandler } from './websocket-handler.js';
+
+/**
+ * @deprecated Use DefaultCertificateProvider instead. This alias is for backward compatibility.
+ */
+export { DefaultCertificateProvider as CertificateManager } from './default-certificates.js';